Introduces a lock while loading credentials from Credential Source

[sruke]

Introduces a lock while loading credentials from Credential Source

Summary of the changes
Ensure multiple requests don't attempt to load the same credentialDescription concurrently.

Description

When a customer configures the source of a token decryption certificate in the inbound policy, SAL attempts to load the certificate from the specified source or retrieves the cached certificate if it has been loaded previously. SAL then creates an X509SecurityKey from the certificate and adds it to InboundPolicy.TokenValidationParameters.TokenDecryptionKeys if the key was not already added. This logic is executed for every incoming token validation request, and SAL utilizes ID.Web's implementation of ICredentialLoader to retrieve the certificate.

Until the certificate is cached by ID.Web (i.e., when credentialDescription.CachedValue is set), multiple parallel requests (potentially exceeding 100 incoming requests, as indicated by Keegan) may attempt to load the same certificate from the source. This raises performance concerns, particularly when fetching the certificate involves making an HTTP request (e.g., fetching from KeyVault).

Open Questions:

1. How does ID.Web detect when a certificate has been rotated?
2. Is the ResetCredentials API invoked when a certificate rotation occurs?

Note: Unit tests will be added once the design is approved

[jmprieur]

@sruke:

How does ID.Web detect when a certificate has been rotated?

IdWeb detects when client certificates were rotated because AAD returns an explicit error

Is the ResetCredentials API invoked when a certificate rotation occurs?

On this error, IDWeb calls ResetCredentials, and retrys the call, which triggers reloading the certificate. This happens here:

microsoft-identity-web/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs

Lines 172 to 178 in cc6fc99

	catch (MsalServiceException exMsal) when (IsInvalidClientCertificateOrSignedAssertionError(exMsal))
	{
	DefaultCertificateLoader.ResetCertificates(mergedOptions.ClientCertificates);
	_applicationsByAuthorityClientId[GetApplicationKey(mergedOptions)] = null;
	// Retry
	_retryClientCertificate = true;

IdWeb does not do anything with decrypt certificate, as the guidance (with IdWeb) is for service owners to provide several decyrpt credentials, and Wilson tries them all.

[jmprieur]

LGTM
Thanks @sruke

I proposed a small tweak.

[jmprieur]

LGTM
thanks @sruke

I proposed a small tweak